On 8/25/20 9:30 PM, Brian Norris wrote:

Also, while technically the regressing commit (e18696786548 ("mwifiex:
Prevent memory corruption handling keys")) was fixing a potential
overflow, the encasing command structure (struct host_cmd_ds_command)
is a union of a ton of other command layouts, and likely had plenty of
padding at the end, which would at least explain why non-malicious
scenarios weren't problematic pre-commit-e18696786548.

This is pretty much spot on, although as far as I can tell, the padding
comes from struct mwifiex_ie_type_key_param_set_v2. That contains a
key_params member, which is a union over all supported key types,
including other 256 bit types (like struct mwifiex_wapi_param).

I should also note that this fix also affects mwifiex_set_aes_key_v2(),
where sizeof(struct mwifiex_aes_param) is used to calculate the command
length of what looks like a command being sent to the chip. This should
probably be reviewed by someone with a bit more inside knowledge about
the driver, as this could potentially break something due to the commit
changing it from 16 to 32. I think, however, that this might actually
also fix a potential issue when setting 256 bit AES keys.

Regards,
Max